Contents

Purchase

Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.

Software

At its core Google Chromecast is Android. Items below can be found that help describe the Chromecast operating environment.

Chromecast Build.prop - A build.prop that details all the config props setup on the device in its shipped configuration.

UART

After taking the Google Chromecast apart and also removing the shielding, you receive access to a 17 point unpopulated pad. This pad contains an RX, TX and GND for UART. Currently this only displays console output from the initial boot process.

A great teardown of the Google Chromecast by ifixit.com is available for disassembling the device.

Bootloader Exploit Package

Items Needed:

Blank USB Flash drive (at least 128MB) –Your drive will be erased–

Our USB Image

Google Chromecast

Powered Micro USB OTG Cable

If not a Powered Micro USB OTG Cable, then find a way to rig up a cable that does just this. We will not provide instructions, it’s simple, but still. Just buy the cable.

Pre-Setup:

Download .zip and extract the "gtvhacker-chromecast.bin" file.

Install our USB image as a whole to your USB flash drive with dd:

Syntax: dd if=gtvhacker-chromecast.bin of=/dev/sdX bs=1024

Root Process:

Plug the flash drive into one female “A” end of the USB OTG cable

Plug the other end into the Chromecast

Hold down the button on the Chromecast while plugging in the power cord.

Watch the screen, and any blinking light on your flash drive. The Chromecast will power up, execute our unsigned kernel, kick off to a script that replaces /system with a rooted one. It will then wipe /data, and reboot back to the normal system. All of this should take about a minute. Don’t unplug anything while it is installing.

When it is complete, your box will reboot, and you will see a new splash screen, and then the Setup screen. Just re-set up your Chromecast, and you can telnet to get a root shell on your Chromecast on port 23!